GhostTrace – a Windows forensic scanner that finds what "Uninstall" leaves behind (22 modules, read-only, offline)
GhostTrace is a Windows forensic scanner tool designed to detect remnants left behind after software uninstallation. It operates offline and read-only, scanning 22 forensic modules including registry keys, prefetch entries, scheduled tasks, WMI subscriptions, and more. The tool aims to provide forensic evidence of persistence, execution, user activity, and installed software traces without modifying the system or generating network traffic. It is intended for investigative use rather than automatic threat verdicts.
AI Analysis
Technical Summary
GhostTrace is a command-line forensic scanner for Windows that identifies leftover artifacts from software uninstallations across 22 forensic modules. It covers persistence mechanisms (e.g., Run keys, services, scheduled tasks, WMI bindings), execution evidence (e.g., Shimcache, Prefetch, BAM/DAM timestamps), user activity (e.g., PowerShell history, RDP history, USB device history), and installed software traces (e.g., uninstall entries, filesystem residues). The tool is read-only by default, does not alter system state, excludes execution caches and history from cleanup, and performs no network communication or telemetry. It is implemented in C# on .NET 10 and supports Windows 10/11 x64.
Potential Impact
GhostTrace itself is not a vulnerability or exploit but a forensic tool that helps identify residual artifacts left by uninstalled software. It does not introduce security risks or exploits. Its impact is to aid incident responders and forensic analysts in uncovering persistence and execution evidence that standard uninstall processes leave behind, improving visibility into potential attacker activity or system state.
Mitigation Recommendations
This is a forensic scanning tool, not a vulnerability requiring patching or mitigation. No remediation or patch is applicable. Users should apply GhostTrace as intended for investigative purposes. Since it is read-only and offline, it does not pose risk to system integrity or privacy. No vendor advisory or patch status applies.
GhostTrace – a Windows forensic scanner that finds what "Uninstall" leaves behind (22 modules, read-only, offline)
Description
GhostTrace is a Windows forensic scanner tool designed to detect remnants left behind after software uninstallation. It operates offline and read-only, scanning 22 forensic modules including registry keys, prefetch entries, scheduled tasks, WMI subscriptions, and more. The tool aims to provide forensic evidence of persistence, execution, user activity, and installed software traces without modifying the system or generating network traffic. It is intended for investigative use rather than automatic threat verdicts.
Reddit Discussion
I built a CLI tool for Windows that investigates software remnants across 22 forensic modules in a single pass.
The idea: when you uninstall software, it says goodbye — but registry keys, prefetch entries, scheduled tasks, WMI subscriptions, BAM/DAM timestamps and more often stay behind. GhostTrace finds all of it.
What it covers:
- Persistence (MITRE ATT&CK TA0003): Run/RunOnce keys, services, IFEO debugger, AppInit_DLLs, scheduled tasks via Task Scheduler COM API, WMI EventFilter/Consumer bindings
- Execution evidence (TA0002): Shimcache (AppCompatCache), Prefetch with XPRESS-Huffman decode (versions 26/30/31), BAM/DAM with per-SID last-run timestamps, UserAssist (ROT13), MUICache
- User activity: PowerShell history with cradle/encoded payload detection, RDP outbound history, RecentDocs, USB device history via USBSTOR, network artifacts (hosts redirects + connected networks)
- Installed software and disk residue: uninstall entries, startup approved state, filesystem trace in Program Files/ProgramData/AppData
Design decisions:
- Read-only by default — scan never touches anything
- Cleanup only after explicit typed confirmation (no implicit click)
- Execution caches and history are excluded from cleanup — you don't destroy evidence
- Zero network calls, zero telemetry
- Suspicious signal is data for analysis, not an automatic verdict
Stack: C# · .NET 10 · Spectre.Console · Windows 10/11 x64
Download on GitHub: github.com/Devzinh/GhostTrace
Happy to answer questions about the forensic modules or implementation decisions.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GhostTrace is a command-line forensic scanner for Windows that identifies leftover artifacts from software uninstallations across 22 forensic modules. It covers persistence mechanisms (e.g., Run keys, services, scheduled tasks, WMI bindings), execution evidence (e.g., Shimcache, Prefetch, BAM/DAM timestamps), user activity (e.g., PowerShell history, RDP history, USB device history), and installed software traces (e.g., uninstall entries, filesystem residues). The tool is read-only by default, does not alter system state, excludes execution caches and history from cleanup, and performs no network communication or telemetry. It is implemented in C# on .NET 10 and supports Windows 10/11 x64.
Potential Impact
GhostTrace itself is not a vulnerability or exploit but a forensic tool that helps identify residual artifacts left by uninstalled software. It does not introduce security risks or exploits. Its impact is to aid incident responders and forensic analysts in uncovering persistence and execution evidence that standard uninstall processes leave behind, improving visibility into potential attacker activity or system state.
Mitigation Recommendations
This is a forensic scanning tool, not a vulnerability requiring patching or mitigation. No remediation or patch is applicable. Users should apply GhostTrace as intended for investigative purposes. Since it is read-only and offline, it does not pose risk to system integrity or privacy. No vendor advisory or patch status applies.
Technical Details
- Source Type
- Subreddit
- netsec
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a290a658dd33fbd85fca4a1
Added to database: 6/10/2026, 6:55:33 AM
Last enriched: 6/10/2026, 6:55:36 AM
Last updated: 6/10/2026, 8:05:19 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.